CVE-2021-29059: ReDOS in IS-SVG
Summary
CVE-2021-29059: ReDOS in IS-SVG. Affects is-svg versions >= 2.1.0, < 4.3.0. Fixed in 4.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
IS-SVG is an npm package used for validating SVG strings. It provides a set of functions to check if a given string is a valid SVG. The package is widely used in applications that process SVG files. However, versions 4.3.1 and below of IS-SVG are vulnerable to a Regular Expression Denial of Service (ReDOS) attack. This vulnerability can be exploited by providing a crafted invalid SVG string, leading to a denial of service condition.
Vulnerability Detail
The vulnerability in IS-SVG arises from insufficient input validation when processing SVG strings. An attacker can send a specially crafted SVG string that triggers a ReDOS attack. This attack can cause the application to consume excessive CPU resources, leading to a denial of service. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5. It is important to note that this vulnerability only affects IS-SVG versions 4.3.1 and below.
How To Fix
Minimum fixed version
4.3.0
This is the first release that contains the fix.
npm install is-svg@4.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating IS-SVG is not immediately feasible, a temporary workaround can be implemented by implementing additional input validation checks on the SVG strings before passing them to IS-SVG. This can help mitigate the risk of ReDOS attacks until the package is updated. Here is an example of how to implement input validation in JavaScript:
const isSvg = require('is-svg');
function validateSvg(svgString) {
// Additional input validation logic
if (svgString.length > 10000) {
throw new Error('Invalid SVG string');
}
return isSvg(svgString);
}
In this example, the SVG string is checked for its length before passing it to the isSvg function. If the length exceeds a certain threshold (e.g., 10000 characters), an error is thrown, indicating an invalid SVG string.
Conclusion
The vulnerability in IS-SVG versions 4.3.1 and below can be exploited by an attacker to cause a denial of service condition. It is crucial to update IS-SVG to version 4.3.2 or above to mitigate the risk. If immediate update is not possible, implementing additional input validation checks can serve as a temporary workaround. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for is-svg →
FAQ
IS-SVG is an npm package used for validating SVG strings. It provides functions to check if a given string is a valid SVG.
A ReDOS attack is a type of denial of service attack that exploits inefficient regular expressions. By providing a specially crafted input, an attacker can cause the application to spend an excessive amount of time matching the regular expression, leading to a denial of service.
The vulnerability in IS-SVG can be exploited by an attacker to cause a denial of service condition. This can result in the application becoming unresponsive or consuming excessive CPU resources, impacting its availability and performance.
Versions 4.3.1 and below of IS-SVG are affected by this vulnerability. It is recommended to update to version 4.3.2 or above to mitigate the risk.
The recommended mitigation is to update IS-SVG to version 4.3.2 or above. If immediate update is not feasible, implementing additional input validation checks on the SVG strings can provide a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for is-svg.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
